【AWS IoT Core】マルチアカウントモードのCA証明書登録をコンソール上からやってみた

# CA証明書用のディレクトリを作成
mkdir -p ~/aws-iot-multi-account/ca
cd ~/aws-iot-multi-account/ca

# CAプライベートキーの生成
openssl genrsa -out rootCA.key 2048

# CA証明書の作成 (例: Common Name を MyDeviceRootCA とする場合)
openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.pem -subj "/CN=MyDeviceRootCA"

# デバイス証明書用のディレクトリを作成
mkdir -p ~/aws-iot-multi-account/device
cd ~/aws-iot-multi-account/device

# デバイスプライベートキーの生成
openssl genrsa -out validDevice.key 2048

# 証明書署名要求(CSR)の作成（デバイスIDを埋め込む）
openssl req -new -key validDevice.key -out validDevice.csr -subj "/CN=ValidDevice/serialNumber=DEVICE123456"

# CSRをCA証明書で署名 (rootCA.pem と rootCA.key は事前に作成したものを参照)
openssl x509 -req -in validDevice.csr -CA ~/aws-iot-multi-account/ca/rootCA.pem -CAkey ~/aws-iot-multi-account/ca/rootCA.key -CAcreateserial -out validDevice.crt -days 365 -sha256

# デバイス証明書とCA証明書を結合
cat validDevice.crt ~/aws-iot-multi-account/ca/rootCA.pem > validDeviceAndCA.crt

# アカウントAにスイッチしてから実行
aws iot describe-endpoint --endpoint-type iot:Data-ATS

{ "endpointAddress": "account-a-endpoint-ats.iot.ap-northeast-1.amazonaws.com" }

curl -o ~/aws-iot-multi-account/device/AmazonRootCA1.pem https://www.amazontrust.com/repository/AmazonRootCA1.pem

pip install awsiotsdk

import json
import time
import threading
from awscrt import io, mqtt
from awsiot import mqtt_connection_builder

# AWS IoT Core endpoint (アカウントA)
IOT_ENDPOINT = "account-a-endpoint-ats.iot.ap-northeast-1.amazonaws.com"

# Certificate paths
CA_CERT = "AmazonRootCA1.pem"  # AWS IoT Root CA
DEVICE_CERT = "validDeviceAndCA.crt"  # Certificate chain
DEVICE_KEY = "validDevice.key"

# Device ID
CLIENT_ID = "TestDevice001"

# Topics
TELEMETRY_TOPIC = f"device/{CLIENT_ID}/telemetry"
COMMAND_TOPIC = f"device/{CLIENT_ID}/commands"

# Global variables
received_count = 0
received_all_event = threading.Event()

# Callback when connection is accidentally lost
def on_connection_interrupted(connection, error, **kwargs):
    print(f"Connection interrupted. error: {error}")

# Callback when an interrupted connection is re-established
def on_connection_resumed(connection, return_code, session_present, **kwargs):
    print(f"Connection resumed. return_code: {return_code} session_present: {session_present}")
    if return_code == mqtt.ConnectReturnCode.ACCEPTED and not session_present:
        print("Session did not persist. Resubscribing to existing topics...")
        resubscribe_future, _ = connection.resubscribe_existing_topics()
        resubscribe_future.add_done_callback(on_resubscribe_complete)

def on_resubscribe_complete(resubscribe_future):
    resubscribe_results = resubscribe_future.result()
    print(f"Resubscribe results: {resubscribe_results}")
    for topic, qos in resubscribe_results['topics']:
        if qos is None:
            print(f"Server rejected resubscribe to topic: {topic}")

# Callback when the subscribed topic receives a message
def on_message_received(topic, payload, dup, qos, retain, **kwargs):
    print(f"Received message on topic {topic}: {payload.decode()}")
    global received_count
    received_count += 1

if __name__ == '__main__':
    # Spin up resources
    event_loop_group = io.EventLoopGroup(1)
    host_resolver = io.DefaultHostResolver(event_loop_group)
    client_bootstrap = io.ClientBootstrap(event_loop_group, host_resolver)

    # Create MQTT connection
    mqtt_connection = mqtt_connection_builder.mtls_from_path(
        endpoint=IOT_ENDPOINT,
        cert_filepath=DEVICE_CERT,
        pri_key_filepath=DEVICE_KEY,
        client_bootstrap=client_bootstrap,
        ca_filepath=CA_CERT,
        on_connection_interrupted=on_connection_interrupted,
        on_connection_resumed=on_connection_resumed,
        client_id=CLIENT_ID,
        clean_session=False,
        keep_alive_secs=30
    )

    print(f"Connecting to {IOT_ENDPOINT} with client ID '{CLIENT_ID}'...")

    # Connect
    connect_future = mqtt_connection.connect()

    # Future.result() waits until a result is available
    connect_future.result()
    print("Connected!")

    # Subscribe to command topic
    print(f"Subscribing to topic '{COMMAND_TOPIC}'...")
    subscribe_future, packet_id = mqtt_connection.subscribe(
        topic=COMMAND_TOPIC,
        qos=mqtt.QoS.AT_LEAST_ONCE,
        callback=on_message_received
    )

    subscribe_result = subscribe_future.result()
    print(f"Subscribed with {str(subscribe_result['qos'])}")

    # Publish test messages
    print(f"Publishing messages to topic '{TELEMETRY_TOPIC}'...")

    message_count = 5
    for i in range(message_count):
        test_message = {
            "deviceId": CLIENT_ID,
            "timestamp": int(time.time()),
            "message": f"Test message {i+1}/{message_count}",
            "temperature": 20.0 + i,
            "humidity": 50.0 + i
        }
        message_json = json.dumps(test_message)

        mqtt_connection.publish(
            topic=TELEMETRY_TOPIC,
            payload=message_json,
            qos=mqtt.QoS.AT_LEAST_ONCE
        )
        print(f"Published: {message_json}")
        time.sleep(1)

    # Keep the connection alive
    print("\nConnection established. Press Ctrl+C to disconnect...")
    try:
        while True:
            time.sleep(1)
    except KeyboardInterrupt:
        print("\nDisconnecting...")

    # Disconnect
    disconnect_future = mqtt_connection.disconnect()
    disconnect_future.result()
    print("Disconnected!")

awscrt.exceptions.AwsCrtError: AWS_ERROR_MQTT_UNEXPECTED_HANGUP: The connection was closed unexpectedly.

cd ~/aws-iot-multi-account/device

# アカウントB用のデバイスプライベートキーの生成
openssl genrsa -out deviceB.key 2048

# 証明書署名要求(CSR)の作成
openssl req -new -key deviceB.key -out deviceB.csr -subj "/CN=DeviceB/serialNumber=DEVICEB001"

# CSRを同じCA証明書で署名（重要：同じrootCA.pemとrootCA.keyを使用）
openssl x509 -req -in deviceB.csr -CA ~/aws-iot-multi-account/ca/rootCA.pem -CAkey ~/aws-iot-multi-account/ca/rootCA.key -CAcreateserial -out deviceB.crt -days 365 -sha256

# デバイス証明書とCA証明書を結合
cat deviceB.crt ~/aws-iot-multi-account/ca/rootCA.pem > deviceBAndCA.crt

# アカウントBにスイッチしてから実行
aws iot describe-endpoint --endpoint-type iot:Data-ATS

{ "endpointAddress": "account-b-endpoint-ats.iot.ap-northeast-1.amazonaws.com" }

# AWS IoT Core endpoint (アカウントB)
IOT_ENDPOINT = "account-b-endpoint-ats.iot.ap-northeast-1.amazonaws.com"

# Certificate paths
CA_CERT = "AmazonRootCA1.pem"  # AWS IoT Root CA
DEVICE_CERT = "deviceBAndCA.crt"  # アカウントB用証明書チェーン
DEVICE_KEY = "deviceB.key"

# Device ID
CLIENT_ID = "DeviceB001"

awscrt.exceptions.AwsCrtError: AWS_ERROR_MQTT_UNEXPECTED_HANGUP: The connection was closed unexpectedly.